Splunk Search

How do I count the number of events based on the value of a field is *

maniu1609
Path Finder

Hello,

I am having trouble with a simple search. I have the following data:

OBJECT ID,NEW STATE
1,STATE ONE
1,STATE TWO
1,STATE THREE
2,STATE ONE
2,STATE TWO
2,STATE ONE
3,STATE ONE

..and so forth

When i run below query, i'm getting count as 4.

index = "SAMPLE INDEX" | stats count(eval('NEW STATE' = "STATE ONE")) as "COUNT"

Now the issue is, when i tried to search for all values( 'NEW STATE'="*") , it gives me count as 0 instead of 7. This is the query i ran,

index = "SAMPLE INDEX" | stats count(eval('NEW STATE' = "*")) as "COUNT"

Tags (1)
0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

HI

If you want to count all event then index = "SAMPLE INDEX" | stats count('NEW STATE')) as "COUNT" is batter.

If you are using dropdown in dashbard then below search will be useful to you.
Let say dropdown token = tokenDropdown then search is:

index = "SAMPLE INDEX" | eval selectedValue="$tokenDropdown$", NEW_STATE=if(selectedValue=="*",'NEW STATE',selectedValue) | stats count(eval('NEW STATE' = 'NEW_STATE')) as "COUNT"

If you select ALL (value=*) in dropdwn then search will be

index = "SAMPLE INDEX" | eval selectedValue="*", NEW_STATE=if(selectedValue=="*",'NEW STATE',selectedValue) | stats count(eval('NEW STATE' = 'NEW_STATE')) as "COUNT"

If you select STATE ONE (value=STATE ONE) in dropdwn then search will be

index = "SAMPLE INDEX" | eval selectedValue="STATE ONE", NEW_STATE=if(selectedValue=="*",'NEW STATE',selectedValue) | stats count(eval('NEW STATE' = 'NEW_STATE')) as "COUNT"

Can you please try this??

Thanks

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Your query is looking for 'NEW STATE' fields with the literal value "*". To count all values, remove the eval from the count.

index = "SAMPLE INDEX" | stats count('NEW STATE') as "COUNT"
---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Splunk Observability Cloud's AI Assistant in Action Series: Auditing Compliance and ...

This is the third post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...